Privacy & Information Security Law Blog : Privacy Lawyer & Attorney : Hunton & Williams Law Firm : Personal Data, Information Security

The Act has been, and continues to be, the subject of much criticism and debate.  The most controversial provisions of the Act are those that seek to reduce online copyright infringement, including:

• an obligation on ISPs to notify their subscribers whose IP addresses are reported by copyright owners as being used to infringe copyright;
• an obligation on ISPs to provide anonymous copyright infringement lists to copyright owners, which may then be used to obtain a court order requiring the disclosure of the identities of the individuals on the list; and
• the power granted to the Secretary of State to enact, in limited circumstances, additional laws that would allow the courts to grant a blocking injunction in respect of an Internet location that the court is satisfied has been, is being, or is likely to be used for, or in connection with, an online copyright infringement activity.

Commentators have taken the view that such provisions potentially may have serious implications for citizens and businesses because they impose an affirmative obligation to monitor networks to avoid being held liable for infringements committed by third parties.  In addition, critics argue that the UK has set a dangerous precedent which other countries may follow, resulting in the monitoring of online activities becoming the norm.  Such developments could lead to infringements of the right to privacy, recognized in most countries as a constitutional or statutory right.

The final text of the Act, which was published on April 12, 2010, may be accessed on the website of the Office of Public Sector Information.

The following are the major findings of the study:

At the European level:

• As confirmed by the European Court of Justice in the Promusicae (Productores de Música de España (Promusicae) v. Telefónica de España SAU (C-275/06)) and Tele2 (LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten GmbH v. Tele2 Telecommunication GmbH (C-557/07)) cases, there is no direct legal conflict between the European legal framework for data protection and online copyright enforcement.
• However, the Court’s decisions leave open several important questions, such as how to apply the proportionality principle in practice and how to strike a fair balance between the various rights involved (i.e., data protection and the right to property).  These issues thus seem to be left to the Member States, and there is little or no harmonization of them at the EU level.

At the Member State level:

• IP addresses are generally considered by DPAs and courts to be personal data, although courts in some countries (e.g., France) have taken conflicting positions on this issue.
• IP addresses are generally considered to be traffic data, which means that they may only be processed in a limited number of circumstances and for specific purposes (such as billing and invoicing), and that consent is generally required to process them for other purposes (such as online copyright enforcement).
• IP addresses processed in the context of online copyright enforcement may be considered to be sensitive data (judicial data), except in Spain.
• ISPs cannot store IP addresses for the specific purpose of online copyright enforcement (except in France, where retention for the purpose of making information available to certain governmental authorities is allowed).
• The processing of IP addresses by ISPs to pass on infringement warning notices is generally prohibited or subject to strict restrictions.
• The general monitoring of P2P networks by right holders resulting in the creation of a database of potential copyright infringers is usually prohibited.
• The disclosure of P2P users’ identities by ISPs to judicial authorities in the context of criminal proceedings is generally authorized.
• The disclosure of P2P users’ identities by ISPs to right holders for civil enforcement is generally restricted by data protection law.  In particular, ISPs generally may not disclose P2P users’ identities to right holders outside the context of judicial (administrative) proceedings.
• In most Member States, it seems that little consideration was given to the interaction between data protection rules and implementation of the IP Enforcement Directive.

As the study demonstrates, the relationship between data protection law and online copyright enforcement is far from being settled.  This issue will certainly be discussed in the coming months during the ongoing debate on the review of the General Data Protection Directive at the European level, and in the context of the debate around possible graduated response mechanisms at the national level.